Hacking and security
-
Hi, we have had some of our sites hacked and i would like your advice on the situation.
We pay a fair but of money for a dedicated server as we thought that by having a dedicated server it would make the sites secure.
The language we use for our sites are joomla and wordpress but yesterday a few of them on the dedicated server were hacked.
the hosting company have sent us the following info
'There is one extra security improvement on the system we may offer you and it is cloudlinux with cageFS. This improves the overall security on the server but will not stop unsecured code exploiting if such coding is present in your website scripts.'
The hosting company is asking for an extra £20 a month to add this on.
we asked the hosting company what they meant by unsecured code and they said:
'Unsecure coding is code in your scripts which will allow injections of files from external source. Unfortunately better explanation is not available and for any detailed information you may check with experience local web developer.'
We thought that the sites would be secured. The hosting company have said that because one of the sites was not updated from joomla 1.5 to joomla 3.0 which we were planning to do this week, this is the reason why it has happened. However, this does not make any sense, as this is a dedicated server so why has the wordpress sites which are up to date been hacked when they are on the same dedicated server.
any advice in understand more on this issue would be great, as i need to find out why this has happened and if i should be taking my sites to another hosting company
-
The wordpress hacking was almost surely due to having outdated version of WP, or having a vulnerable plugin installed. There are a few helpful plugins you can use to secure your WP site, plugins like (http://wordpress.org/plugins/better-wp-security/).
also a couple things to note, you should also take basic measures to project the site by changing the default table prefixes of your DB from _wp, create a new admin user and delete the default "admin" accoun & limit access to your wp-admin section in your .htaccess file.... these security plugins will give you a whole checklist of items to "secure".
-
I have only used dreamhosts shared hosting, don't know about dedicated.
"would you expect the hosting company to let you know that your site has been hacked or is it down to yourself to know"
Generally no, that you be your responsibility (or if your have a maintenance contact with the web developer).
Again dreamhost has some cool auto safe guards eg one of my clients had malware/virus on his pc and was sending out spam, they auto reset the password when it was picked up. I also think they have other auto features to inform you about hacking, but its guaranteed service, its just a bonus they do.
I'm not saying you should go with dreamhost, I'm just telling you what they can/have done, (i have only use a few host companies) but I'm sure there are alot of hosts that do that too (maybe even more).
-
will have to look at dreamhost and see how much they charge for dedicated server. do they offer managed dedicated server. also the hosting company is not taking any responsibility.
would you expect the hosting company to let you know that your site has been hacked or is it down to yourself to know
-
What your saying is true, but I have never heard of anyone getting hacked (bar brute forcing password or poor passwords), if they keep upto date with the security fixes.
Some hosts eg dreamhost will auto update installs for you , so you don't have to worry about updating.
-
I don't think its the server, wordpress and other cms are continually hacked. The server can not stop much at all. your code needs stop most hacks, and since wordpress is used by so many, all some one needs to do is hack their own and then they can go out and hack all wordpress sites of the same version.
-
Yeah standard, "its not our problem" response.
As I said before, if the joomla site shared something like mysql database access then it was most likely not the hosts fault.
I have seen hosts blame opensource cms when actually they were just trying to hide their issues. Its going to be impossible to know until someone looks properly into it (which hosts will not do, which is fair enough).
-
just got this from my hosting company
Hello,
1. The server was not hacked. The application on these account has been compromised. In order to have the exact reason and coding vulnerability which allowed this to happen you may contact certified developer as we do not offer development services at this point.
2. Review the above. What we do is secure the service on the server by applying all the patches available for the same. The coding and the updates on your website functions and coding is your responsibility. The review and patching of any script you use for your website is development related task.
3. Again you will have to request this from expert web developer as s/he may review the coding of your website and provide the reason why and how it has been compromised.
4. Contact certified developer with proven feedback to review and patch your websites coding.
5. The answer to this question you may check here:
Should you have any further questions or comments please do not hesitate to contact us.
Best regards,
-
i am waiting for the hosting company to get back to me, they have been working on this now for over 24 hours, i have sent them some questions but they have said they cannot answer them yet. it seems strange that the wordpress sites were hacked and they were all hacked even though they all had seperate logins
-
I'm not an expert (but have some experience) , but if they are truly separated, and the word press sites were up to date but were hacked too, then there is something very wrong.
-
ok thanks. The sites all have their own access but are all on the dedicated server. they can all be gained through a whm where we can change cpanel passwords and usernames but besides that they have no connection.
-
If each site was on a different domain and were completely separate (separate ftp access, separate mysql database access, no master/common username and passwords etc) then that might point to a problem with the hosting side, but to be honest it really hard to know, with our proper investigation.
Since your not technically minded you would be better getting someone with more technical knowledge to review you current setup to see if it was the hosts failing or it was the way you have your sites set up, there is just too many unknowns to get conclusive help from a forum.
Hope that helps
-
hi, it is a managed dedicated server where they look after everything.
there is a joomla site on there that was not hacked but all the other sites were hacked including wordpress.
all the wordpress sites were upto date but there were three joomla sites that were in joomla 1.5 instead of joomla 3.
we were told when we moved up to a bigger and newer dedicated server it was secure from hacking but we have now been hacked.
i am trying to find out, how this has happened, this happened over 24 hours ago and still they are sorting out putting the back up of the sites live but it seems to be taking a long time.
we have another site on there which is not ours who we let use the space and they have a it expert on board who claims this should not have happened even if there was a older joomla site on there.
they claim that the hosting company should have made everything secure and has suggested we move to a better server that is secure.
i am not technically minded so not sure what we should do, if it was the hosting company fault or not.
-
When you say dedicated do you mean a "managed" dedicated server? or are you in charge of server maintenance?
As for joomla I think there are security updates for 1.5 (best check if its still supported, just make sure you have them upto date. to late now unless you have a backup before the hack then, update straight away and change passwords (there is a how to recover from a hack guide for this on the joomla site)
If the hacker got into you joomla site and was able to get you database passwords and if that was a master user account that also had access to the wordpress database then I could see how they could have gotten into both. Of if the word press site is on the same domain as the hacked joomla site, then again they could get into the wordpress site. Or if you used common usernames or passwords for the different sites.
But the most important with any opensource software is to make sure that your uptodate with security fixes, because as soon as there is a exploit found script kiddies search the web for vulnerable site and have there fun. I'm know what "cloudlinux with cageFS" is but as your host says it would not have stopped this hack.
Got a burning SEO question?
Subscribe to Moz Pro to gain full access to Q&A, answer questions, and ask your own.
Browse Questions
Explore more categories
-
Moz Tools
Chat with the community about the Moz tools.
-
SEO Tactics
Discuss the SEO process with fellow marketers
-
Community
Discuss industry events, jobs, and news!
-
Digital Marketing
Chat about tactics outside of SEO
-
Research & Trends
Dive into research and trends in the search industry.
-
Support
Connect on product support and feature requests.
Related Questions
-
Recovery After A Hack - No Manual Action Notice
Hi Guys, I am helping out an agency who have had a couple of site hacked on their server. I can confirm by correlating increase in not found errors and drop in rankings, that the drop was definitely hack based although the site had no manual action notice from Google. The site looks to have been fixed i.e all not found pages look to have been sorted. Obviously there are some dodgy backlinks to now non existant pages but it looks like two months on no sign of a recovery. Is this normal?, Could the site still be hacked and the web designer is claming it has been cleaned up? I am used to dealing with hacked sites when there has been a manual action listed and then it's quite easy to complete the clean up work, submit a reconsideration and then get the manual action revoked but when you don't receieve a manual notification and the site doesn't recover, what do you do? Kind Regards Neil
Technical SEO | | nezona0 -
Site hacked in Jan. Redeveloped new site. Still not ranking. Should we change domain?
Our top ranking site in the UK was hacked at the end of 2014. http://www.ultimatefloorsanding.co.uk/ The site was the subject of a manual spam action from Google. After several unsuccessful attempts to clean it up, using Securi.net and reinstating old versions of the site, changing passwords etc. we took the decision to redevelop the site. We also changed hosting provider as we had received absolutely no support from them whatsoever in resolving the issue. So far we have: Removed the old website files off the server Developed a new website having implemented 301's for all the old URL's (except the spam ones) Submitted a reconsideration request for the manual spam action, which was accepted. Disavowed all the spammy inbound links through Webmaster Tools Implemented custom URL parameters through Google to not index the SPAM URLs ( which were using parameters) Our organic traffic is down by 63% compared to last year, and we are not ranking for most of our target keywords any longer. Is there anything that I am missing in the actions I have taken so far? We were advised that at this stage changing domain and starting again might be the way to go. However the current domain has been used by us since 2007, so it would be a big call. Any advice is appreciated, thanks. Sue - http://www.ultimatefloorsanding.co.uk/
Technical SEO | | galwaygirl0 -
Site hacked, but can't find the code
Discovered some really odd words ranking for us in WMT. Looked further and found pages like this www.pdnseek.com/wll/canadian-24-hour-pharmacy. When you click it it redirects to the home page. The developers can't find /wll anywhere on the site. The pages are indexed and cached. Looked at the back links in moz and found many backlinks to our site from other sites using URLs like this. The host says there is nothing on the server, but where else could it be. We've run virus scans, nothing, looked through source code, nothing. Anyone with some idea? www.pdnseek.com is the URL
Technical SEO | | Britewave0 -
Secure and non-secure Schema.org Markup?
Is it possible to have schema.org itemtypes for both secure and insecure ports? I run a static-ish site made in Jekyll, and am implementing Schema.org on the individual pages. As a result, I'm trying to use the following: This doesn't validate with Google's Rich Snippet Tool. It doesn't register the Items as existing. Is there a good way to implement Schema.org in a static page hosted on both SSL and non-SSL ports?
Technical SEO | | RoxBrock0 -
Ecommerce and Secure Checkout
We made changes several months ago trying to become compliant with Google Trusted Stores. This change effects our secure checkout. Here is an example website:www.froggysfog.com once you go to checkout:
Technical SEO | | marketing_zoovy.com
https://www-froggysfog-com.app-hosted.com/c=gbY1kT9hZx1OJrCN07bHz3tTy/s=www.froggysfog.com/checkout.cgis
Once you have gone to checkout all the links are changed:
https://www-froggysfog-com.app-hosted.com/category/10-fluid.10-fog/ I know I can remove the session ID in webmaster tools, but I'm not sure what else I should be doing to ensure that these links are not indexed. We have the robot.txt set up to not index anything in checkout or that is on secure: http://www.froggysfog.com/robots.txt However, due to the entire url change when on secure. I'm wonder if I need to set up in webmaster tools to exclude any url with app-hosted.com or if there is a better option. thank you0 -
Websites being hacked & duplicated, what should we do?
Hi, please help! Our website was hacked and being totally duplicated. They even injected codes to intercept our orders. Although the codes issue had been solved, still there're two mirror sites out there. When search for some of our key words, they even have good ranks. What exactly can we do to let Google ban those two sites. Thanks in advance!
Technical SEO | | Squall3150 -
Hacked Server IP Range Penality?
I use a justhost.com reseller account to host about 15-20 of my own websites. None of the sites are related, nor do I interlink or do anything blackhat with any of them. All of the sites have unique content. Some of it isn't great, but I didn't use a writing service on any of then, it was all written by myself. Recently I found a list of my sites (as well as about 200 others hosted by justhost) on a hacker website that listed the cpanel usernames. I alerted the host and the issue is being fixed. I am changing all of my usernames and passwords for all of the sites. Anyway, I recently took a look at some analytics and rankings and noticed that I lost a lot of my rankings on a handful of those sites recently. I know there was the big de-indexing of junk blogs recently, but I don't think that is the case. I can still find all of my sites in Google, they are just out of the first 50 results, when a majority of them were ranked from 5-20 in the SERPs. Here are three of the sites and their phrases: http://nintendoconsoles.com/ "nintendo consoles" - This domain I bought from someone so there could be some sort of sandbox period for it. http://webhostingfordrupal.com/ "web hosting for drupal" - This was a new register. http://seotirical.com "seotirical" - we don't show up, but all of the tweets and links to us do. - This was a new register. I realize these sites aren't perfect, and might not have been ready for the first page. The Nintendo site is about 3 months old, but the Drupal site has been around for 8+ months. I might try adding a fresh piece of content tonight to see if that helps, but I thought it was curious that it happened across the board with about 5-6 sites on my one reseller account. I don't even know if the top portion of this post has anything to do with the problems, but I thought I'd see if anyone has insight. Cheers,
Technical SEO | | vforvinnie
Vinnie0 -
What are your thoughts on security of placing CMS-related folders in a robots.txt file?
So I was just about to add a whole heap of CMS-related folders to my robots.txt file to exclude them from search, and thought "hey, I'm publicly telling people where my admin folders are"...surely that's not right?! Should I leave them out of the robots.txt file, and hope for the best that they never get indexed? Should I use noindex meta data on every page? What are people's thoughts? Thanks, James PS. I know this is similar to lots of other discussions around meta noindex vs. robots.txt, but I'm after specific thoughts around the security aspect of listing your admin folders in a robots.txt file...
Technical SEO | | James-Distinction0